NVIDIA NemoClaw

NVIDIA NemoClaw is an open-source reference stack from NVIDIA that hardens OpenClaw always-on AI agents with sandbox isolation, network policy controls, and routed inference. Announced 16 March 2026 at GTC, it ships under Apache 2.0 with 20,000+ GitHub stars and runs on RTX PCs, DGX Spark, and DGX Station for local, always-on autonomous agents.

What NVIDIA NemoClaw does:

• •One-command CLI install the nemoclaw CLI is a TypeScript plugin layered on the NVIDIA OpenShell runtime, installed via curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash. The CLI handles onboarding, sandbox lifecycle, inference provider selection, and policy edits without touching Docker config files by hand.
• •Hardened OpenShell sandbox every NemoClaw agent runs inside an OpenShell container with Landlock filesystem locks, seccomp syscall filters, and network namespacing. /sandbox and /tmp are writable, system paths are read-only, and privilege escalation is blocked at the kernel level.
• •Routed inference (Model Router) inference calls leave the sandbox through a host-side inference.local proxy. The optional Model Router provider chooses an NVIDIA Nemotron model per request, so credentials stay on the host while the agent only sees a controlled endpoint.
• •Local Nemotron 3 models on DGX Spark NemoClaw bundles Nemotron 3 Super 120B and other open NVIDIA weights for fully local inference on DGX Spark or DGX Station. Token costs go to zero and no prompt data leaves the device.
• •Cloud Privacy Router when local models are not enough, NemoClaw can route specific requests to frontier cloud APIs (OpenAI, Anthropic) within a defined allowlist. Egress is enforced by the OpenShell L7 proxy, not the agent code.
• •Hot-reloadable network policy administrators see blocked egress attempts in real time and can approve or deny destinations without restarting the sandbox. This is the single biggest reason teams pick NemoClaw over running OpenClaw bare-metal.
• •Versioned blueprint architecture the CLI plugin stays small while orchestration logic lives in a Python blueprint that ships with cryptographic digest verification. Blueprints can be pinned, audited, and rolled back independently from the CLI.
• •Multi-channel messaging NemoClaw inherits OpenClaw's connectors for Telegram, Slack, and Discord, so the same hardened agent can answer messages on any channel without per-platform config.
• •Persistent workspace and snapshots agent state, files, and chat history live in a managed workspace that supports backup and restore, so a long-running agent can be migrated between RTX, DGX Spark, and DGX Station hosts.
• •Open source, Apache 2.0 the full NVIDIA/NemoClaw repo (TypeScript CLI plus Python blueprint) is on GitHub for inspection, fork, and contribution. The 20k+ star count makes it the most-starred sandboxed-agent stack on GitHub in 2026.

Pricing:

• •Self-hosted $0: free forever under Apache 2.0. You pay only for your hardware (RTX PC, DGX Spark from $3,999, or DGX Station) plus optional cloud API tokens if you route to OpenAI or Anthropic.
• •DGX Spark hardware (optional) from $3,999: NVIDIA's recommended always-on platform for NemoClaw. Cloud and Jetson deployments also work but are documented as alternative paths.
• •Cloud API costs (optional) pay-per-token to whichever frontier provider you allowlist in the Privacy Router. NemoClaw itself adds zero subscription cost.

Limitations:

• •Alpha software, not production-ready NVIDIA's docs explicitly warn that APIs and behaviour may change without notice. Do not run NemoClaw in production until the project hits a stable release.
• •Hardware-locked to NVIDIA OpenShell, Nemotron, and the bundled stack assume NVIDIA GPUs. AMD, Apple Silicon, and pure-CPU deployments are not supported and there is no roadmap to fix that.
• •No managed SaaS option there is no NVIDIA-hosted NemoClaw service. You manage the host, the sandbox, the credentials, and the upgrades yourself.
• •Steep operator skill floor the install assumes Linux, Docker, Node.js 22.16+, and basic kernel-policy literacy. Non-technical operators will not get past onboarding without a developer on hand.
• •Sandbox is not bulletproof the official docs acknowledge that no sandbox fully blocks advanced prompt injection. Treat NemoClaw as defence in depth, not a silver bullet for agent security.